Posted
by
CmdrTaco
on Monday October 04, 2004 @11:32AM
from the good-'cuz-i-forgot-my-password dept.

An anonymous reader writes "IBM has added biometric security to its thinkpad notebooks. The next generation of T series thinkpads will have an integrated fingerprint scanner for added security. The latest machines will also include some pretty cool encryption software, that will keep your hard disk safe, but still let you backup and restore images. This guy managed to get his hands on an early prototype T42 with the new security features integrated."

"IBM has chosen to go with a swipe-scanner rather than a touch-scanner, for a number of reasons. First and foremost is that a swipe-scanner provides better security. Because you have to drag your fingertip across the scanner, there is no way to "lift" a fingerprint from the surface."

That is a great idea. Such an elegant solution to what could have been a big problem.

...except for the multitude of partial prints left all over the keyboard and the touchpad...

Hmm. I guess the question then becomes: How accurate of a digital recreation can we make from partials? If it's enough to pass biometric verification then there's no need to waste money/time on a fingerprint scanner.

A lock and key is only good if you make it a point to lock it each and every time you get up from your desk. Your laptop can be just as easily stolen as you make a quick run to the restroom as it can be if you left it unattended overnight.

Not only that, but an attacker would probably only find out after taking the laptop. And trust me, they normally won't bring them back after finding out. And you can always get the drive, DVD, battery and harddisk out after trashing the case.

Does this mean you can hack it to record your friends' (or co-workers') fingerprints? Sounds fun and scary.

No, you can't. From the article:"Of course since the Power On security layer is something that occurs well before Windows has started up, the fingerprint data can't be stored in a Windows file or folder. Instead, the fingerprint scanner itself stores the fingerprint data and retrieves it when the Power On security request is made. You can store a total of 21 profiles in the scanner, which should be more than enough, unless you share one notebook between a score of users. If you're worried about someone extracting the fingerprint data from the scanner and breaking your security, dont be. The scanner only stores a tiny amount of data for each fingerprint, just enough to ensure an accurate match, and nowhere near enough to recreate a complete fingerprint."

"The scanner only stores a tiny amount of data for each fingerprint, just enough to ensure an accurate match"

Unless I'm an idiot, this means that the amount of data the scanner stores is inversely proportional to its accuracy. For example, if one were to store a critical 20% of the data neccessary to recreate a fingerprint, with use of the partials on the keyboard and the top of the laptop, one should be able to recreate the print accurately enough using means like a laser (3d) printer, a bit of spare rubb

The "partial data" is almost certainly a checksum, that takes hundreds of datapoints and combines them into one non-reversible number. This is also done with text passwords.

A xerox of a finger won't work, since this is not an optical scanner. it measures the capacitance between ridges. Any fake is going to need to be 3D, have the electrical properties of a human, and be swipeable (so perhaps not jello..)

Both wrong. The data stored is usually some kind of array or matrix of the finger minutiae (relative position, direction, etc). No serious fingerprint identification system compares -images-. Te image of the fingerprint is analyzed, the minutiae are extracted, and that's used to perform the matching against the database. A single fingerprint can contain more than 50 minutiae, while 12 are enough to identify a person.

actually, it's very easy: if people are willing to let you borrow the computer, they will be willing to log you onto it (unless they're lending it to you to use as a doorstop or something) or even add your fingerprint to the list of authorized fingerprints.

"...make a fake finger from a lifted print..." - don't make me laugh. You watch too much tv mate: the first thing to try when you want somebody's password is asking them for it.

There are several vendors over here in Germany that offer Thinkpads with Linux [nofost.de]. It's an offer specifically targeted at students, you get comparatively large discounts. The devices are still too expensive, compared with US prices, though... (I hope one day we'll actually reap the benefits of the US trade balance;))

At present, however there's only an R51 model on sale... and even that is somewhat of a weird offer, it ships with XP preinstalled, and you get an install CD for a custom IBM version of SuSE 9.

I was just at their website configuring a laptop for a business purchace. While I have to say their range of laptops are pretty slick their UI designer should be shot.

Back on topic now, this laptop is nifty in itself. EArlier on another/. article, the hordes were in an uproar about the data security module in laptops. After seeing one on the website and with technical information, both the prior articles mentioning and this new biometric feature are for the purpose of protecting the users data from theft and not for "corporations" protection against "us". It wasn't engineered that way. Maybe in a few years that will happen, but to appease the paranoid crowd here - this is _FOR_ us. not against.

If they designed it in such a way that the LEA backdoor is secure (say, it's got an LEA public key on it, and the private key is kept in the forensics labs), I'll buy one tomorrow. I don't have a need to defend against.gov adversaries - I just want to know that the data on my drives remains secure even after someone steals 'em to get his or her crack fix.

If, however, they designed it in such a way that the backdoor is not secure (say, a default password stored in cleartext on a serial EEPROM), that's another story. I'll download the crack when it comes out next week, and my soldering iron and I will have an endless supply of cheap entertainment when the machines start showing up at the surplus stores in 2009.

I'll download the crack when it comes out next week, and my soldering iron and I will have an endless supply of cheap entertainment when the machines start showing up at the surplus stores in 2009.br>
Good thinking, you will need something to do in the evenings anyway...since Conan O Brien is taking the tonight show.

If they designed it in such a way that the LEA backdoor is secure (say, it's got an LEA public key on it, and the private key is kept in the forensics labs), I'll buy one tomorrow. I don't have a need to defend against.gov adversaries

LEA means Law Enforcement Access. Some crypto and other security tokens [as in hardware, not Kerberos] have what is called LEAF - the Law Enforcement Access Field. The tokens themselves can be referenced as 'non-LEAF' and 'LEAF-enabled'.

That may be true, but, playing devil's advocate, just because information (e.g., keys) is stored on government information systems doesn't mean that the government is the only body who has access to it. You are implicitly relying on a specific department or agency to secure their information systems.

Even if it can... it is not totally useless. Strong authentication theory basically says for an authentication method to really be strong it has to be comprised of two parts: something you have, and something you know.

Biometric measurements are attractive candidates for the "something you have" part because they are unique, in most cases easy to read and convenient... i.e. never left behind. On there own though they do not provide a strong authentication solution... but even then, a large bit-length key

Read my post again and actually think about it this time. I made a distinction between stealing a token and forging a token. The reason this distinction is important is that you are aware of a theft (missing finger or token) but may not be aware of a forgery because you still have yours and the person attempting to crack your system is using an illicit copy.

The significance of this is that while it is hard/unlikely to physically take your fingerprint from you, while not trivial, it is not extremely diff

There was an interview in Business 2.0 a couple years ago with an individual who claimed she had had a very similar problem: she had just finished a presentation for a conference; the weekend before the conference she had a mishap in the kitchen and burned her finger, so she couldn't use the biometric authentication mechanism on her laptop. Her solution? She got on a plane and went to see her twin sister in Florida. She actually claimed in the article that "twins have identical fingerprints" and her s

The fingerprint setup software looks identical to the iPAQ that has the bioscan feature. That was a PktPC app, tho, so the real issue is whether someone will develop a Linux bio-encrypter for this laptop.

Otherwise it would remain a Win-only feature and useless to the converts.

Yes, but if your data is worth *that* much, I suppose you'll have a better way of protecting it, won't you? For most of the stuff on my computer, I'd just laugh and give them my password if it came to that...

For an IT manager, biometric security will make life much easier. Gone will be all those phone calls from users who've forgotten their passwords. And there will be no more worries about insecure passwords, or even keystroke loggers, trapping passwords and passing them onto hackers and fraudsters.

Gone may be phone calls for forgotten passwords but there'll be plenty of new calls as to why their fingerprints aren't scanning. The function of accuracy for fingerprint scanners varies according to things such as the skin's elasticity. This changes with age, humidity, cuts, etc. So biometrics aren't a 100% fix. There will always be "goats," the people for whom biometrics just doesn't work well, including the biometrics professor around here who's missing a fingertips (not due to any experiment mishap, mind you). I'd also worry about the security of your stored biometric data. Hopefully it'd be a hash and not the raw data, which could be harvested and used. Then again, I wonder what the incidence of collisions in a hash that uses biometric data is?

Well you beat me to revealing the PR hype. In addition, if the fingerprint suddenly stops working for some reason (let's say our employee was bricklaying the last weekend, or doing an intensive Vitamin C exfoliation) is there a way of getting the computer to boot? And if there is, what's the point? It's just expensive snake oil.

Not only easier, but also more secure. A common username and password is only 1-factor authentication (they're both something you can know). Using a username and biometric is 2-factor authentication (in this case, someting you are and something you know). For 3 factor authentication you need to cover: something you know, something you have, and something you are.

Biometrics stored for authentication are stored in a reduced, non-reversable format. Its designed to be searched and matched, but not extracte

Hey, we read your post fine the first time. No need to post it again;) Seriously, though, my own experience with fingerprint scanning has been just awful. A friend and I were going to do a work-from-home call center gig which required that we purchase a fingerprint scanner which would be used to log us on to the customer database.On average, it took up to 15 min to get the fucking thing to work.We quickly ditched that company but ended up severalhundred bucks in the red.

This is nothing more than false security for pointy haired induhviduals. A clueful cracker with console access can usually get access to data. If the laptop is stolen, so is the data and no fingerprint widget will prevent it.

But what makes SafeGuard Easy so special is that it works with IBM's own Rescue and Recovery utility. The problem with encrypted data is that when you try to restore an image of an encrypted hard drive, all the data, including the boot records just look like garbage to the restore program. But with SafeGuard Easy, you can keep the entire contents of your drive encrypted, and still be safe in the knowledge that should your hard disk crash, you can restore all your data to a new drive despite the fact that it's encrypted.

Has anyone here used or admined IBM's lotus notes? I feel real good about trusting IBM with my encrypted HD.

Has anyone here used or admined IBM's lotus notes? I feel real good about trusting IBM with my encrypted HD.

Are you aware that:

Lotus Notes had the first commercial implementation of a Public Key Infrastructure (PKI), and it's still by far the largest commercial deployment of a PKI.

Lotus Notes has never had a security incident where a virus or worm successfully attacked it via Notes native interfaces or e-mail. (There have been some security patches required in the Internet-compatible interfaces.)

Lotus Notes has never had a security incident where a virus or worm successfully attacked it via Notes native interfaces or e-mail. (There have been some security patches required in the Internet-compatible interfaces.)

Would that be because it runs on a popular OS that has a security model based on Swiss cheese, thus eliminating the need to crack the app? I am actually asking not trolling, I do not know what Notes runs on.

A clueful cracker with console access can usually get access to data. If the laptop is stolen, so is the data

RTFM.

Do you know how password protection and data encryption works on laptops? No, you don't.

There are several layers of security involved. First, the BIOS and the HDD both have password authentication mechanism. The BIOS stores its passwords on a custom chip which scrambles its I/O. Resetting the BIOS master password is possible, but it requires a highly modified chip programmator and a skillful person.

The HDD stores its password on the platter and requires it before it will allow access to any data. To bypass this mechanism, you must engineer your own HDD controller chip which will skip the authentication and the PCB for it and transplant it in place of the one on the HDD. This is virtually impossible unless you have very good friends in the HDD manufacturer company.

Finally, after the HDD allows access, the software encrypts selected files using strong encryption and stores the keys on the secure (TCPA) chip. The secure chip requires a passphrase before it will allow access to the keystore. It is virtually impossible to bypass this and retrieve the keys from the secure chip without knowing the passphrase.

Therefore, to retrieve the data from the stolen laptop's HDD, you must first possess either extreme competence in electronics or extremely good illicit connections in the industry, and second, brute-force industrial-strength encryption on the files. Good luck.

I love my Thinkpad. I had a T30 before that stayed on 24/7 for over a year. The only time it was turned off was to/from vacation. The rest of the time it was a workhorse. Now I have a T42P and love it as much or more. Functional and VERY stable. Sure, it doesn't have some super new gizmos like others, but it works every time.

Every time someone asks me about a notebook I recommend IBM. They go out to Best Buy and get some other brand with 20 other options they don't need and then get mad when it breaks or isn't stable. Thanks IBM!

The company I work for is buying IBM T41's and now T42's (IBM is deprecating T41's). We've purchased several hundred of them, and apart from failed video adapters in the first batch of units they are great. The ones with bad video adapters well all fixed without any questions asked in a short period of time.

I have to agree with most posters, the laptops are very well thought out and designed, and really easy to work on if you ever need to take anything apart.

I Had a 570e for three years, and have a T41p since january. Both are great laptops which work with no glitch under Linux (except the 570e's winmodem). I carry my laptop all the time in a standard backpack and use it both at work and at home, in trains, public places, etc. It is thus under serious physical stress.

The 570e had a screen failure when I was living in France, and despite I bought it in the US, and had lost all the related documents (I did not even remembered where I bought it), IBM accepted w

This is cool though. I like how IBM put the fingerprint ID tech in front of Windows. That means Linux based OSs can also take advantage of this when these machines are being sold as refurbished in a few years.

I'm a little disappointed that the encryption stuff may not transfer well to non-Windows OSs.

Now what happens when someones finger is damaged to due fire, electrical shock, or blunt trauma? I had this problem with an old Compaq laptop that had a system password at the BIOS level. It made the laptop permanently mine since I didn't want to disclose my password to anyone else.

I know there's room for 21 different fingerprints, but I wonder how many end users are going to think to register more than one of their fingers...just in case.

I would be very surprised if IBM didn't create a Linux version of this encryption software themselves . They are very Linux friendly and are always making strides to port their software for their hardware to Linux.

If you don't want an IBM Thinkpad for the fingerprint scanner, the APC fingerprint scanner/biometric reader seems to work pretty well. I saw it for $29 or so at Fry's yesterday.

My friend bought one a while back and used it rather successfully on his Dell D800 before he had to give the computer back to his employer. It was pretty accurate in scanning his fingerprint. He never got locked out of his machine.

I can't remember if the machine would NOT allow a login without the reader or not. If it would, th

In theory and from what I have read on the article, it will be a great device for security. But I don't think people will really realize how annoying this feature will become.
If it gets damaged, no more using computer.
If you get a nice little scare on the finger you choose to scan, no more using comptuer (unless of course you add more than one finger, but still).
I guess this is one of those things that the government should use, I don't know how easy or useful it would be used for a personal use compute

So what happens if I get a papercut, lose a finger, lose a hand, somehow wind up with a scar over my finger or something? Is there any way to get at the data or is it lost forever unless I brute force the keys?

Sure, thats all well and good, but is the API to the hardware scanner components exposed in such a way that allows Linux developers such as myself to poke at it, and write a compatible AES encryption layer to interface with it?

Encrypting a Windows machine prior to login is nice, but in the rest of the world, the GUI is the last thing we run, not the first.

In Windows, you run the GUI, and execute the shell.

In Linux (and most Unixes), you run the shell, and execute the GUI. Its a very different paradigm

Never use biometrics to control access to critical data. Barring such silliness as using toeprints, biometrics allows you 10 credentials (or only 2 is using full palm prints).

If your RSA key is compromised, you can just generate another. You can do this as often as necessary. However, if you fingerprint is compromised, all you can do is switch fingers. Nine compromises later, you're SOL.

Now for ordinary folks who just use this to keep others from messing with their laptops, this isn't an issue. However, if security is critical, biometrics just won't cut it.

I am the guy they quoted in the original press release. I have one of these babies in my hands and let me tell you... pretty cool stuff.

My 2 cents...

The fingerprint reader is of a type that has not been 'fooled' yet. Yes, contact readers are easy to fool. This is not a contact reader. It reads the capacitive properties of the ridges and valleys that make up your finger print. This is actually quite cool since a severed finger does not have the same capacitive properties, and the reading is of live tissue *under* the skin, not your dead skin at the surface. So, a minor injury isn't going to be a big deal and the mafia cannot cut your finger off and use it. Furthermore, the extra small footprint of the reader is nice because there is less opportunity to damage the reader with scratches.

The idea is to register more than one finger and fingers from both hands. Of course, nothing is foolproof, but the idea here was to include a low cost yet effective way to provide biometric access control to the laptop. The embedded security system (ESS) protects a lot of things including a password vault. Password vaults have their drawbacks, the most obvious of which is if you have the 'master' password, you now have *all* of the passwords that user has stored in the vault. Average users tend to use simple master passwords, making the password vault a huge risk. This is a way to provide the functional equivalent of a strong password to unlock the vault without making the user have to remember a complicated password or some hardware key.

I am very impressed with the entire package. I think it will make it much simpler for IT to deploy things like ESS without destroying all of the value in ESS because users choose crappy passwords. There are a number of add-ons that make it very appropriate for enterprise deployment, including centralized key storage and disaster recovery software.

My biggest problem to date with this kind of software was it hasn't been real reliable in the recovery category. I could make it very secure, but God help me if I had a hard drive crash or an OS go belly up. The 'backups' of this data were often times 'too secure' to be recovered. This latest package of hardware/software has many of the previous holes filled in and I am happy to report success in all of the tests I have conducted so far.

Of course, anybody can implement this poorly. However, IBM has done a stellar job with it this time. I feel privileged to get to play with stuff like this.

This [heise.de] article from 2002 claims that most fingerprint readers available to joe user by that time were easy to fool. Easy as in: press a plastic bag filled with warm water on it to replay the last print.Are we looking at a new, better generation of readers today or are they still as insecure as they used to be?

Typically posed as a trollish question, this author may or may not have had trolling in mind. I for one would like to know if there are any plans for the T42 Biometric laptops to have Linux run on them.

No, that's just the point. The encryption is done by the HD firmware, not the OS. It's just like the present IBM (now Fujitsu) drives which have a BIOS password. It doesn't matter where to install the drive, the chips that say: "move the head here" don't do anything until provided with the password. It used to be you had to do a platter transplant to get around this, but I think there is some way to recover now, but it still requires a factory tech and isn't something like a backdoor password.

How the hell does you mind work? ANYONE can steal a laptop. I've seen a 13 year old in an airport try to walk away with one and you're saying that a 13 year old kid could reproduce my fingerprint accurately enough for a scanner to read it? Shut up and read the articles. Maybe even google the technology in the article so you can comment on it intelligently...